ANNEX A.1 TECHNICAL SPECIFICATIONS. OPEN CALL FOR TENDERS No F-SE-12-T10 WEB APPLICATIONS HOSTING SERVICES

Transcription

1 ANNEX A.1 TECHNICAL SPECIFICATIONS OPEN CALL FOR TENDERS No F-SE-12-T10 WEB APPLICATIONS HOSTING SERVICES

2 Table of Contents 1 Technical specifications Objectives Definitions and Abbreviations 4 2 Title of the Contract 5 3 Overview of Services 5 4 Overview of current situation Existing externally hosted infrastructure Minimum hardware infrastructure Minimum software infrastructure 6 5 Service requirements General conditions for the provision of services Web Application Hosting services Types of Web-hosting environments General conditions for the provision of services Availability Response Time Backup and Recovery Server Availability Security Restore times Web Hosting environment services Standard Hosting services Production environment Standard Hosting services Staging environment Support Take-over and hand-over of existing web-applications Place of work and delivery Communication Language 13 6 Project management and progress reporting Project organisation Quality assurance Project monitoring and reporting Acceptance of deliverables 15 Page 2

3 7 Description of profiles Project Manager Database Administrator Web Application Administrator 17 8 Required information Management of daily operations Processing of data back-ups Measures taken in response to any incident Take-over and hand over 19 List of Tables Table 1: List of terms 4 Table 2: Service restore times 10 Table 3: List of profiles 16 Page 3

4 1 Technical specifications 1.1 Objectives The objective of the Agency is to provide the relevant institutions, bodies, offices and agencies of the Community and its Member States implementing Community law with assistance and expertise relating to fundamental rights in order to support them when they take measures or formulate courses of action within their respective spheres of competence to fully respect fundamental rights. The Agency became operational on 01 March The Agency intends to sign a framework contract for the provision of Web Applications Hosting services as described in the present document. 1.2 Definitions and Abbreviations The following table lists the abbreviations and definitions term used in the present document. Term FRA FRA WCM (new) FRA WCM (old) FRA InfoPortal FRA survey software FRA web statistics software Definition European Union Agency for Fundamental Rights This is the new FRA web content management system which uses the Drupal CMS and hosts the Agency s website. It replace the old WCM in September This is the old web content management application based on BEA Weblogic 9.2 and ORACLE 10g technologies that hosts the Agency s website. It was replaced by the new Drupal 7 WCM in September This is an information portal application based on BEA Weblogic 9.2 and ORACLE 10g technologies. It is foreseen that this version of the InfoPortal may be replaced by a new version using Drupal or another technology in 2013 or This is online survey software used by the FRA, the PHPbased LimeSurvey This is the web statistics software used by the FRA. Currently this is Google Urchin 6 which will be replaced in the near future by the open source web statistics software Piwik. Table 1: List of terms Page 4

5 2 Title of the Contract The title of the contract is Web applications Hosting services. 3 Overview of Services The services that could be requested by FRA relate to the hosting of web applications (including provision of back-ups and access logs). The Agency s current policy is to outsource internet based web applications to ensure the highest quality of services to its stakeholders. The following section provides an overview of the applications presently in use by the FRA. This list is provided in order to present an overview of the technologies presently in use by the FRA. Hosting services maybe requested to be provided either in a virtual environment or in a stand-alone physical environment depending on the nature of the web applications. 4 Overview of current situation 4.1 Existing externally hosted infrastructure The FRA s presently externally hosted web applications, which form the subject of the current CFT, are as follows: - FRA web content management system (new WCMS): this is the new WCMS based on Drupal 7 which hosts the FRA website as of 25 September FRA website CMS (old): Based on Java, Bea Weblogic 9.2 and ORACLE 10g technologies. The application was replaced by a new WCM using Drupal 7 in Sept No longer used for web content management but needs to be kept running for purposes of e-recruitment. - e-recruitment application: Based on Java, Bea Weblogic 9.2 and ORACLE 10g. - FRA InfoPortal: Based on Java, Bea Weblogic 9.2 and ORACLE 10g. This application hosts the FRA s online databases of fundamental rights related information (Charterpedia and Case Law Database). It is planned that the application will be replaced by a new one (using Drupal or another technology) in 2013 or FRA survey software: A platform for online surveys that uses the PHP-based application LimeSurvey. - FRA web statistics software: the FRA will use the open source software Piwik for its web statistics. This will replace the old statistics software (Google Urchin 6, hosted internally at FRA). Page 5

6 The FRA reserves the right to add or remove applications to the above list of externally hosted applications as it sees fit. 4.2 Minimum hardware infrastructure The minimum hardware infrastructure must be sufficient enough to support any of the following technologies online with the manufacturer s minimum specifications: Drupal 7 PHP 5.3 or higher J2EE or equivalent BEA Weblogic v. 8.1, 9.2 or higher. ORACLE 10g or equivalent Microsoft SQL server or equivalent MySQL Linux Microsoft Exchange Server Tenderers are requested to provide the necessary hardware for any possible combinations of the above listed technologies. 4.3 Minimum software infrastructure The contractor should be able to provide the necessary software requirements that match the web applications needs. In particular, the minimum software infrastructure for the different technologies and operating systems should not be older than two versions than the latest version in the market. 5 Service requirements 5.1 General conditions for the provision of services The technologies and tools used for the provision of the services and products should be in line with the technologies listed under section 4.1 and 4.2 or equivalent. 5.2 Web Application Hosting services The present service requirements and related points lay down the minimum guaranteed service level requirements. The general scope of this section is to list the overall parameters associated with the delivery of hosting services under the contract. Software licenses such as BEA Weblogic or ORACLE will be provided by FRA. Page 6

7 5.3 Types of Web-hosting environments The agency may request any of the following types of web-hosting services: Shared Hosting: In this case the hardware is owned by the contractor. The Agency s content and applications are located on a server and storage infrastructure that is shared with other customers of the contractor. In this case the Agency understands that there are limitations in customising the hosting environment to its needs. Virtual dedicated servers: This hosting environment is similar to the Shared Hosting environment but it allows the Agency to install its own applications or request installation by a contractor and customize its setup. Dedicated hosting: In dedicated hosting, the Agency should receive managed server infrastructure dedicated solely to its needs in the form of one or more stand-alone servers that are virtualized allowing the Agency to host one or more web applications. 5.4 General conditions for the provision of services The contractor has to accept the minimum service requirements presented here; however, the contractor is allowed to propose an improved service level in each of the categories hereafter. In addition, if the contractor proposes an improved service level, the contractor will be bound to this proposal after acceptance by FRA and may not afterwards revert to the minimum requirements as set out in the present document Availability Definition: Measures the availability of the Web-hosted application. This provides the service recipient with the percentage of time that the application(s) were available for use in a specific month. Requirement 24 hours per day, 7 days per week (365 days a year) Measurement Range Low = 99.8%; High = % Compliance Measurement Frequency Calculation Formula Maintain Web-hosting application availability in good working order so that service recipient and client activities can take place within defined time frames. Monthly Total available hours/by total hours (less scheduled maintenance hours) in measurement period. Each server x 24 hours x days (average work days in a month) = "Monthly Available" to define if "Service Level Page 7

8 Attained" Response Time Definition: Measures the time taken to refresh the screen with requested information after the request is entered. Requirement Measurement Range Compliance Frequency Calculation Formula 24 hours per day, 7 days per week (365 days a year) Low = Page load target within 5 seconds; High = Page load target within 1 second; Maintain Web-hosting applications availability in good working order so that service recipient and client activities can take place within defined time frames. Monthly Response Time: <Y seconds. Formula: Time it takes for all characters to appear on an end-user screen from inquiry request initiation NOTE: The response time is also dependant in the way the web application is structured. In case web pages take longer to load then the measurement range maybe adjusted accordingly following agreement between the Agency and the Contractor Backup and Recovery Definition: Perform incremental backups (including of the access logs for web statistics) on a daily, weekly and monthly basis as required by the organization. The Agency may request additional back-ups of surveys running on the FRA survey software. Requirement Measurement Range Compliance Frequency 24 hours per day, 7 days per week (365 days a year) Low = 99% of the time; High = 99.99% of the time. Perform daily backup, maintain minimum 7 daily cycles, 6 weekly, 13 monthly. Perform one recovery test per year upon the Agency s request. Monthly Page 8

9 Calculation Formula Data Sources Confirm backup/recovery from backup/recovery logs Provide reporting of the back-up functions including date and time-stamp capabilities and status Server Availability Definition: The percentage of time that the server is available for normal business operations. Requirement 24 hours per day, 7 days per week (365 days a year) Measurement Range Low = 98%; High = 99.95% Compliance Frequency Calculation Formula Data Sources Maintain server in good operating condition so standard/normal organizations activities can take place within defined time frames. Monthly Total available hours/by total hours in measurement period = "service level attainted." Example 12x5 = each server x 12 hours x 21.6 days (average work days in a month) = "Monthly Available measurement period" Tool supplied by service provider that automatically records via "date and time stamping" for each activity within a process including uptime and downtime data Security The contractor will provide full description of security measures taken to protect the applications and the data from intentional or accidental damage and from unauthorised access, such as: Server security management Timely application of security patches Human error reduction The contractor must ensure that the latest patches and operating system updates are performed to ensure security. In case there are incidents where security breaches occurred then the Agency should be informed. Page 9

10 5.4.6 Restore times The service restore time is the time needed by the contractor to provide a solution to restore the service. During normal working hours (08:30 17:30) (Central European Time), the following reaction times are expected. Item Critical Urgent Normal Response times 90% within 1 hour, 10% within 2 hours 95% within 2 hours, 5% within 4 hours 95% within 4 hours, 5% within 6 hours Table 2: Service restore times The tenderer should provide estimates for exceptional requests outside the normal working hours (as defined above). 5.5 Web Hosting environment services The following specifications should be provided for any of the above listed types of web hosting environments: shared hosting, virtual dedicated servers and dedicated hosting. For the standard hosting services and management of daily operations both a Production environment and a Staging environment are required. The Production environment hosts the applications (see Section 4.1 for list of applications) as described below. Tenderers should provide a diagram of both Production and Staging environments, showing all machines, software installed and network connections The performance of the staging environments should not match the one of the production as access to it will be limited to web team members and the contractors that develop and maintain the applications. Therefore, it should be kept to the minimum Standard Hosting services Production environment The standard hosting services for Production are as follows: Provision of: Disc space of 50GB UPS power backups Tape back-up service or other back-up service; Connection via: o HTTP access to the hosted applications o FTP (or sftp) access to the hosted applications and environment o SSH connection Page 10

11 These connections should allow remote access to the hosting environment which is necessary for application deployments, patches or running SQL scripts etc. A close collaboration with other FRA Contractors developing and maintaining the web applications is required. SSL support and provision of SSL certificates (x3) to be charged on a monthly basis. Guaranteed direct connection to a major internet backbone is required. An estimated bandwidth of GB/month is expected. Streaming audio and video capabilities The tenderers should describe how they will maintain, check, monitor and report as described in section 6.3 on the services requested. This includes the allocation of human resources, description of all hardware and software used. The table below shows the resources currently required by the applications on the existing Production environment. Application Size Database size New WCM/website 2.9 GB 1.7 GB Infoportal 1.8 GB 6.0 GB e-recruitment 3.7 GB 25.0 GB Survey software 79.0 MB 7.8 MB Statistics software 24 MB NA Old WCM 3.7 GB 25.0 GB Other (static mini-sites etc) 31.0 GB - NA = not available Average website traffic was around 2 million hits per month (94.3 GB/month) for the first 6 months of It is estimated that the website traffic could grow by 15-25% per year in the next few years Standard Hosting services Staging environment The purpose of the Staging environment is to allow the FRA to test new software, enhancements to the existing systems, etc. The FRA will specify which of the applications on the Production environment should also be on the Staging. The applications on the Staging environment (including all content) should be synchronised regularly with the Production environment so that Staging reflects Production as closely as possible. Page 11

12 The standard hosting services for Staging are as follows: Provision of: Disc space of 10GB UPS power backups Tape back-up service or other back-up service; Connection via: o HTTP access to the hosted applications o FTP (or sftp) access to the hosted applications and environment o SSH connection These connections should allow remote access to the hosting environment which is necessary for application deployments, patches or running SQL scripts etc. A close collaboration with other FRA Contractors developing and maintaining the web applications is required. The tenderers should describe how they will maintain, check, monitor and report as described in Section 6.3 on the services requested. This includes the allocation of human resources, description of all hardware and software used. 5.6 Support The contractor should provide the necessary support and ensure that the following types of changes are addressed, if requested by FRA. It is expected that the following types of changes maybe requested by FRA: Standard change Complex change Emergency change The implementation time is the elapsed time between the assignment of the change request to the contractor and the closing of the change request. The service offered will be evaluated on a monthly basis. It is expected that the: The maximum implementation time (during working hours) for a standard simple change: 4 hours. The maximum implementation time (during working hours) for a complex change is: 6 hours. The maximum implementation time (24h/24h 7days/week) for an emergency change: 3 hours. Page 12

13 5.7 Take-over and hand-over of existing web-applications FRA may request the take-over and hand-over of the existing web applications from the current web application hosting provider and installation to the tenderer s hosting environment. FRA will provide the necessary web-application documentation including installation manuals for the take-over. The contractor should provide a detailed plan describing how it plans the take-over to ensure a smooth continuation of service. This activity includes the hosting environment preparation and not installation of the application that will be performed by another party. For a hand-over, the contractor shall describe how documentation will be prepared and the hand over will be organised. 5.8 Place of work and delivery The implementation of the services will be undertaken at the contractor s premises. When face to face meetings between FRA and the contractor are needed, these will take place at FRA s premises in Vienna. Where possible, meetings between FRA and the contractor can be made by utilising modern technologies such as video conference systems or Microsoft Lync. 5.9 Communication Communication between the tenderer and the FRA must be possible by phone, electronic mail, fax, normal and registered mail, and a communications solution such as Microsoft Lync or equivalent Language The working language of FRA is English. The English language shall be used throughout the project duration for all communication, reports and other documentation. 6 Project management and progress reporting Under this activity, the overall management of the above activities will be ensured by the contractor(s) under the supervision of FRA. 6.1 Project organisation The project organisation will consist of the contractor(s) project team and the project officer of FRA. The contractor(s) shall nominate a project manager to have on his/her behalf overall responsibility for the execution of the project. The selected tenderer shall supply the Page 13

14 curriculum vitae of the proposed project manager and other members of the project team. A back-up for the nominated contractor project manager in case of unavailability should also be nominated. In addition, a description of the tasks, responsibilities and profiles of all members will be provided. Any change of project related personnel occurring once the contract has been signed shall be notified to FRA in writing. The FRA shall agree to the proposed changes in writing following the review of the curriculum vitae of the new member to assess if it is in line with FRA s requirements. The project manager will ensure that the work under the contract is executed according to the specifications and with respect to the contractual deadlines. The project manager will be responsible to ensure quality-check of all deliverables and to respect the project management and quality plans. FRA will nominate a project officer to monitor the project schedule and its progress. He or she will be the main point of contact for the contractor. The project officer may be assisted by other FRA officers, if deemed necessary. The contractor will be informed in such case. FRA will also nominate a back-up for the project officer in case of unavailability. 6.2 Quality assurance The contractor(s) shall supply an overall Project Management and Quality Plan (PMQP). At minimum, the PMQP should include details of: The quality assurance methodology to be applied by the contractor, including relevant quality check-points and indicators related to the contract, the contractor's project organisation, including the main points of interface with the FRA, a detailed project schedule, project deliverables and timing, an Acceptance Plan including all milestones, deliverables, review, activities and dependencies for the timely and efficient completion of the contract, the project s critical path, a risk assessment and risk mitigation procedures, a list and description of actions required to be taken by the FRA. The PMQP should be of sufficient detail to enable the FRA to evaluate progress and assess the QA methodology applied. The PMQP shall be one of the project deliverables, being subject to the approval by the FRA. If a need arises, the PMQP should be updated to reflect the current situation (again subject to FRA s approval). Page 14

15 6.3 Project monitoring and reporting The FRA shall nominate one or more Project Officer(s) who will ensure project monitoring (e.g. Technical, Administrative). The contractor shall prepare and submit a monthly progress report to FRA, addressing at least the following points: the current status of the project, an analysis of any problem experienced and corresponding corrective actions, taken or proposed, justification of any details occurred, current resource consumption per team member. any actions required to be taken by the FRA, The last month of the Specific Contract the contractor(s) shall prepare and submit a Final Report to FRA, addressing at least the following: Details of the results achieved, Quality assurance methods applied, Deviations from the original project plan with detailed justifications, Description of problems encountered and solutions adopted, List of deliverables inline with the Specific Contract. The final report will be subject to FRA approval. Following the approval of the final report all deliverables will be provided to FRA as defined in section Acceptance of deliverables The procedure for accepting the deliverables shall be the following: FRA receives the deliverables according to the contract deadlines, During the progress report meetings, the contractor presents the deliverables for discussion with the FRA, Further actions which, in the opinion of the FRA, would be necessary for the acceptance of the deliverables will be undertaken by the contractor without delay. A new deliverable which takes into account comments or suggestions made by the FRA will have to be re-submitted within (2) two weeks unless specified otherwise. The contractor provides the FRA with access to an online database or bugtracking system in order to monitor possible bugs and problems. Both parties will enter problems and bugs faced as tickets. The contractor will update the status of the tickets on a daily basis during the implementation period. All reports and related documentation delivered to FRA shall be written in English. Page 15

16 The contractor shall produce one (1) CD-Rom versions of the project deliverables. 7 Description of profiles The required profiles are provided in the following table. PROFILE Project Manager Database Administrator Web Application Administrator 7.1 Project Manager Table 3: List of profiles Required Nature of the tasks Project management including proposals for project strategies, planning, definition of tasks and deliverables, review of project deliverables, quality control, risk analysis and management, project status reports, problem reporting and management systems, follow up and organization. Provide effective leadership for the project team ensuring that team members are motivated and constantly developing their skills and experience. Be in-charge of project activities and review deliverables. Participate in functional and technical working groups and progress meetings. Estimate monitors costs, timescales and resource requirements for the successful completion of each project to agreed terms of reference. Prepare and maintain project and quality plans and tracks activities against the plan, provide regular and accurate reports. Manage the change control procedure following agreement for revisions to the project from project sponsors. Qualifications and professional experience 7.2 Database Administrator YES YES YES University degree A minimum of eight (8) years of professional experience out of which a minimum of three (3) should be in IT project management Proven experience with quality procedures and IT service management in at least 2 projects Excellent knowledge of English (level C1 based on Common European Framework of Reference) Nature of the tasks Database administration (administer database login, access rights etc.) Setup of instances and distribute schema on them. Resource monitoring and planning. Tuning of database instances. Problem diagnosis and solving. Page 16

17 Qualifications professional experience and Security monitoring. Availability monitoring of services provided by the servers Automation of iterative tasks (writing of scripts) Technical documentation writing related to the database administration procedures. University degree A minimum of 5 years in database administration, development and maintenance in ORACLE, MS-SQL and MySQL Professional certification as a Database Administrator Very good knowledge of the English language is required (Level B2 based on Common European Framework of Reference (CEF)). 7.3 Web Application Administrator Nature of the tasks Ability and previous experience in administering web applications based on different web technologies in particular Drupal, PHP, J2EE,.NET, BEA Weblogic, MOSS, ORACLE, MS-SQL, MySQL and LimeSurvey Register maintenance incidences Provide solutions for given incidences. Technical evaluations examining incidence reports. Install and upgrade applications and operating systems. Deploy installation patches. Qualifications and professional experience 8 Required information University degree Minimum 5 years in IT, of which a minimum 3 years should be experience in maintenance support and administration of web applications. Very good knowledge of the English language is required (Level B2 based on Common European Framework of Reference (CEF)) Tenderers are invited to propose their best organisation and resource allocation to carry out the different tasks. The tenders are requested to provide their technical proposals, explaining: 8.1 Management of daily operations The tenderers are invited to describe how they will organise the tasks following the conditions set out in Section 5.5 by providing descriptions of: Hosting type: This will be of dedicated hosting (see section 5.3 for definition). Hard Disc space: Provide information on the required hard disk space and additional hard disk space requested by the contractor. Page 17

18 Data back-up and retrieval strategy: Describe the back-up strategy used (daily, weekly, monthly etc.) ensuring that back-ups from previous months to can be retrieved, stating the number of months for which back-ups can be retrieved. Power backup: Provide information of the available power back-up strategy in case of power shortages and failures. Internet connection: High performance internet connection is expected for end-users when accessing the web-applications. Describe the connection bandwidth and failover strategy that will be employed to address these needs. HTTP and FTP access: The application administrator should able access the application using HTTP and FTP. Describe the characteristics of such connections to ensure high performance when accessing the application s back-end and staging environments. Telnet and SSH access: The application administrator should be able to access the hosted applications using telnet and or SSH access. Service provisions: The tenderers must ensure that the requirements described under section 5.4 are met. SSL support and provision of certificates: the tenderer should provide the services of secure socket layer connection upon request including provision of certificates. Streaming audio and video: The tenderer should be able to provide support for audio and video streaming upon request. A financial offer for a monthly flat rate should be given. Reporting: The following reporting services should be provided: Monthly reports to be provided latest until the 5 th day of the month following the review period. 8.2 Processing of data back-ups The tenderers are invited to describe how they will organise the tasks following the conditions set out in section by providing descriptions of: - Data back-up and retrieval strategy - Power backup 8.3 Measures taken in response to any incident The tenderers are invited to describe how they will organise the tasks following the conditions set out in section by providing descriptions of - Response time - Recovery measures Page 18

19 8.4 Take-over and hand over The tenderers are invited to describe how they will organise the tasks following the conditions set out in section 5.7 by providing descriptions of - Preparation activities - Documentation Page 19